{
  "finding_id": "DF-5640",
  "status": "reproduced",
  "reproduced": true,
  "impact": "panic",
  "confidence": "certain",
  "verdict": "tsc_cputimer_register() (cputimer_tsc.c:145-156) copies the unvalidated hardware/calibration-derived tsc_frequency into tsc_cputimer.freq and calls cputimer_select(), whose cputimer_set_frequency() divides (1000000LL<<32)/freq (kern_cputimer.c:190) -> #DE -> fatal trap 18 -> boot-time kernel panic whenever tsc_mpsync was forced (hw.tsc_cputimer_force=1, or ncpus==1 with invariant TSC) while TSC calibration returned 0. Reproduced live on the dfbsd-qemu guest: harness replayed the registration body verbatim with freq=0 via the real cputimer_register/cputimer_select entry points; production divq faulted at cputimer_select+0x29, guest dropped to DDB, ssh died. Severity Low: trigger requires loader (root) tunable or lying/broken hardware; no unprivileged runtime surface exists (all three globals are boot-time only, sysctl RD).",
  "exploit_chain": "",
  "evidence": "panic.txt: Fatal trap 18: integer divide fault while in kernel mode + Stopped at cputimer_select+0x29: divq %rcx,%eax; panic_serial.log: full serial console with DF5640 live-state lines showing tsc_mpsync=1/tsc_frequency=0 precondition then TSC: cputimer freq 0; forced_boot_dmesg.txt: the REAL production path executed under hw.tsc_cputimer_force=1 (TSC: cputimer freq 3600008821, kern.cputimer.name=TSC); fix_run.log: patched kernel prints cputimer: refusing zero frequency for DF5640 (cputimer unchanged) and survives (SURVIVED-rc=0)",
  "kernel_refs": [
    "sys/cpu/x86_64/misc/cputimer_tsc.c:145",
    "sys/cpu/x86_64/misc/cputimer_tsc.c:155-156",
    "sys/cpu/x86_64/misc/cputimer_tsc.c:162",
    "sys/kern/kern_cputimer.c:99",
    "sys/kern/kern_cputimer.c:190-191",
    "sys/platform/pc64/isa/clock.c:980-1043",
    "sys/platform/pc64/isa/clock.c:1513-1516",
    "sys/platform/pc64/isa/clock.c:1522"
  ],
  "poc_changes": "Seed PoC sketch replaced entirely: (1) a boot-loaded KLD cannot precede tsc_cputimer_register because preloaded modules link at SI_BOOT2_KLD (0x1e00000) after SI_BOOT2_POST_SMP (0x1cc0000) -- proven empirically with a forcing SYSINIT that ran too late; (2) final harness replays cputimer_tsc.c:145-156 verbatim at kldload time on a replica struct (pri=CPUTIMER_PRI_DUMMY-1 so only the pre-pri-check sink call at kern_cputimer.c:99 can fire), driving the real cputimer_register()/cputimer_select() production entry points with tsc_frequency=0.",
  "attempts": 3,
  "guest_uname": "DragonFly dfbsd 6.5-DEVELOPMENT DragonFly 6.5-DEVELOPMENT #0: Thu Jul 2 06:02:54 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64 (baseline); patched fix kernel #1: Fri Oct 9 03:49:03 UTC 2026",
  "runtime_sec": 2400,
  "guest_dirty": 0,
  "build_cmd": "./build.sh  (guest: cd /root/df5640 && make; KMOD df5640 via sys/conf/kmod.mk)",
  "run_cmd": "./run.sh  (guest: kldload /root/df5640/df5640.ko)",
  "code_hash": "839f50eb875691d766709b6b187ec9758db825b08bb94d309ce76807ed74c0b9",
  "notes": "Impact ceiling is boot-time DoS (panic), NOT uid0: no memory corruption, operands are boot-time globals, sysctl RD, tunable lives in /boot/loader.conf (root). Complementary live introspection: stock guest runs HPET with tsc_mpsync=0/tsc_invariant=0, so the files registration is inert on the stock config (early return cputimer_tsc.c:134). cpucounter half (cputimer_tsc.c:162-170) is currently dead surface: cpucounter_find/cpucounter_find_pcpu have no callers outside kern_cputimer.c. Guest reset to clean with-src snapshot after validation.",
  "recommended_fix": "Guard tsc_frequency==0 before registering the TSC cputimer/cpucounter (cputimer_tsc.c, both the mpsync path and the regcnt path) and add a zero-frequency guard to cputimer_set_frequency() (kern_cputimer.c).",
  "fix_status": "fixed",
  "fix_baseline_reproduced": 1,
  "fix_patched_reproduced": 0,
  "fix_verdict": "fix.diff applied in guest /usr/src; make nativekernel KERNCONF=X86_64_GENERIC + installkernel (RC=0, fix_build.log); rebooted into patched kernel #1 Oct 9 03:49:03. Identical harness: no trap, cputimer: refusing zero frequency for DF5640 (cputimer unchanged), module load returns 0, system healthy with HPET unchanged. Legit-path regression: hw.tsc_cputimer_force=1 boot still selects the TSC cputimer (TSC: cputimer freq 3600009374, kern.cputimer.name=TSC).",
  "fix_evidence": "fix_run.log (warning + SURVIVED-rc=0), fix_build.log (kernel install completed RC=0), fix_forced_boot.txt (legit forced path still registers TSC), fix.diff (git apply -p0 --check clean against sys/)",
  "fix_kernel_uname": "DragonFly 6.5-DEVELOPMENT #1: Fri Oct 9 03:49:03 UTC 2026 root@dfbsd:/usr/obj/usr/src/sys/X86_64_GENERIC x86_64"
}